Splunk Search

Community Activity

Event log cannot be fully displayed in Field Extractor Hey fellow Splunker's. I'm trying to extract some fields from Windows event logs. When I search these logs the conten... by LuiesCui Communicator in Splunk Search 03-12-2019 0 4	0	4
How to extract filename from the path? Hi All I want to extract file name from the path Ex: ..../../default/folder/temp.txt output: Filename temp.txt by eduspk Explorer in Splunk Search 03-12-2019 0 2	0	2
Why is a lookup working on one search head and not another? How can I determine: 1) Why a Lookup is working on one search head but not on another? 2) How to get it to work on ... by DavisLee New Member in Splunk Search 03-12-2019 0 4	0	4
How to add a word after a count? Hello I use the search below and I would like to do 2 different things 1) How to do for adding a word after the stat... by jip31 Motivator in Splunk Search 03-12-2019 0 4	0	4
How to filter name by id which start with a specific number? Hi All Please help me with rex to filter name by id which start with "9" . Ex: Sample log ContactId:"12345,5678,9... by eduspk Explorer in Splunk Search 03-12-2019 0 2	0	2
How to search a lookup table or file by the column that has timestamp I'm trying to pull events from a lookup file that has in one column a timestamp. There will be instances where I'll ... by wtaylor149 Explorer in Splunk Search 03-12-2019 0 5	0	5
Need to search all request based on IP address I have these pattern in logs and I want to search burst of requests coming from one IP address For example: line: ... by varshna New Member in Splunk Search 03-11-2019 0 6	0	6
How to sort the column names alphabetically at the end of the search? This is my sample search: \| makeresults \| eval data = " 1-Sep 657 34 35; 2-Sep 434 34 35; " \|... by HattrickNZ Motivator in Splunk Search 03-11-2019 0 3	0	3
How do I add an extra row to calculate the average of the rows above? I have connected to my database using Splunk DBConnect and using a simple sql query I have managed to get some data f... by BobKimata Path Finder in Splunk Search 03-11-2019 1 3	1	3
How to find a log entry that doesn't have a match with another one? So, I get a bunch of log entries that look something like this (grossly simplified) example: host1 tag - foo host1 t... by mortya New Member in Splunk Search 03-11-2019 0 1	0	1
How to get the first and last number of consecutive integers by search? Hello Splunkers, Need your help on this. This is my query for testing: \| fields id \| sort id \| delta id AS delta... by Oracle Explorer in Splunk Search 03-11-2019 0 4	0	4
'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d" (earliest vs. earliest_time) Greetings, 'earliest': '03/09/2019:17:07:00' is significantly slower than "earliest_time": "-2d". Is this a known i... by coreybfoulds New Member in Splunk Search 03-11-2019 0 2	0	2
How to edit my search to compare a lookup table to an index? I have tried all of the examples but am still not getting accurate results. I have a lookup table with (1) column on... by tlmayes Contributor in Splunk Search 03-11-2019 0 6	0	6
Why is rename not working for Timechart Lists? Hello, I'm running into an issue trying to rename timechart lists. I'd like to give these a more friendly presentati... by jason16v Engager in Splunk Search 03-11-2019 0 2	0	2
How come our INPUTLOOKUP is returning no results? I'm trying to get this use case going from MS Windows AD Objects, but I can't get any results. index=wineventlog sou... by sbgoldberg13 Explorer in Splunk Search 03-11-2019 0 4	0	4
How do I perform a stats count(fieldname) without it deleting all other search results output? I do believe I'm missing something fundamental here.... So, the search: index=X returns many events where each even... by williamcharlton Path Finder in Splunk Search 03-11-2019 0 4	0	4
How to select yesterdays date from the following search? Hello, I know it is a simple question but I am somehow struggling with it. I have the following search: index=mlbso... by damucka Builder in Splunk Search 03-11-2019 0 1	0	1
Efficient and "correct" way to counting stats based on a sequence of events within a rolling timeframe Creating stats count based on a sequence of events within a timeframe. For example, count the unique sessions, withi... by mlorrette Path Finder in Splunk Search 03-11-2019 1 4	1	4
How to use of Group by on the Event Number column to get the latest result by EventTime? I have a table like below in Splunk I want to apply a group by on Event Number col and want to get the top(latest) ... by nilanjankc New Member in Splunk Search 03-11-2019 0 6	0	6
External URL link with Hyperlink in alert message body Hi Splunkers, Is it possible to add an External URL as Hyperlink in the message body of an alert? I know we can pl... by dadepu Engager in Splunk Search 03-11-2019 1 3	1	3
How to catch information from inspector job? Hi I would like to catch the information in the example below: This search has completed and has returned 1 000 rés... by jip31 Motivator in Splunk Search 03-11-2019 0 2	0	2
Some logs were missed by splunk in search index While using splunk, we are missing some events in search index. There is no repeated behavior of this kind but they a... by chandrajay New Member in Splunk Search 03-11-2019 0 0	0	0
How to use plus sign before a result to calculate percentage? Hello I use the eval below in order to calculate a percentage \| eval Trend_Proc_time=round(100-(Proc_dest*100)/(Proc... by jip31 Motivator in Splunk Search 03-11-2019 0 4	0	4
How do I search from a lookup table and match when part of a string from an events' field matches a value in a lookup table? Hi all, I know many questions exist similar to this one but none are useful for my particular use case. Please if s... by nickcardenas Path Finder in Splunk Search 03-11-2019 1 9	1	9
How to use rex to extract username from emailid? Hi All Please help me to extract username from the emailid. Ex: test123@test.com abc2@test.com Required: test123... by eduspk Explorer in Splunk Search 03-11-2019 0 1	0	1